Snowflake Integration: Test Audit Log and Workflow Activity Flow

Schema Reference

The Ironclad audit log table has the following structure. Column names are lowercase and should be wrapped in double quotes in Snowflake queries.

Common gotchas

• There is no top-level workflow_id column. Extract it from "event_data" using "event_data":workflowId::string.
• "event_time" is stored as microseconds since epoch, not as a Snowflake timestamp. Convert it with TO_TIMESTAMP_NTZ("event_time" / 1000000).

Test the Integration

Part 1: Confirm the integration is live

Step 1: Query the audit log directly

Your role may not have privileges for SHOW TABLES, but direct SELECT queries can still work.

SQL
SELECT *
FROM <YOUR_DATABASE>.<YOUR_SCHEMA>.<YOUR_AUDIT_LOG_TABLE>
LIMIT 10;

If rows return, the integration is live and you have the access you need.

Step 2: Inspect the columns

Use this query to confirm the available column names and casing:

SQL
SELECT *
FROM <YOUR_DATABASE>.<YOUR_SCHEMA>.<YOUR_AUDIT_LOG_TABLE>
LIMIT 1;

Check the result grid and confirm the exact lowercase column names.

Step 3: Capture a baseline timestamp

Convert the latest event time into a readable timestamp:

SQL
SELECT TO_TIMESTAMP_NTZ(MAX("event_time") / 1000000) AS last_event_synced 
FROM <YOUR_DATABASE>.<YOUR_SCHEMA>.<YOUR_AUDIT_LOG_TABLE>;

Record this value. Any test activity you generate next should appear after this timestamp.

Part 2: Generate test activity in Ironclad

Trigger the following categories of activity to confirm each event flows into Snowflake.

Test A: Admin change

In Ironclad, go to Company Settings → Users & Permissions or another admin area.

Make a small, reversible change, such as:

• Add or remove a user from a group
• Update a workflow configuration setting
• Change a tag or property

Note the time of the change.

Test B: Workflow comment

Open any in-progress workflow.

Add a comment such as:

Snowflake sync test - [your initials] - [timestamp]

Submit the comment.

Test C: Add an approver

In the same workflow, or another active workflow, add yourself or a teammate as an Approver. Note the workflow ID from the URL.

Test D: Take a workflow action

Take a workflow action such as:

• Approve
• Sign
• Reject
• Cancel

Note the time of the action.

Part 3: Validate activity in Snowflake

Wait about 2 to 5 minutes, then run the following queries.

Query 1: View the most recent events

SQL
SELECT
TO_TIMESTAMP_NTZ("event_time" / 1000000) AS event_ts,
"event_name",
"actor_email",
"event_data":workflowId::string AS workflow_id,
"event_data"
FROM <YOUR_DATABASE>.<YOUR_SCHEMA>.<YOUR_AUDIT_LOG_TABLE>
ORDER BY "event_time" DESC
LIMIT 25;

You should see your recent admin change, comment, approver addition, and workflow actions near the top.

Query 2: Filter to events from the last hour

SQL
SELECT
TO_TIMESTAMP_NTZ("event_time" / 1000000) AS event_ts,
"event_name",
"actor_email",
"event_data":workflowId::string AS workflow_id,
"event_data"
FROM <YOUR_DATABASE>.<YOUR_SCHEMA>.<YOUR_AUDIT_LOG_TABLE>
WHERE "event_time" / 1000000 >= DATE_PART(EPOCH_SECOND, DATEADD(HOUR, -1, CURRENT_TIMESTAMP()))
ORDER BY "event_time" DESC;

Query 3: Filter to events after a specific date and time

SQL
SELECT
TO_TIMESTAMP_NTZ("event_time" / 1000000) AS event_ts,
"event_name",
"actor_email"
"event_data"
FROM <YOUR_DATABASE>.<YOUR_SCHEMA>.<YOUR_AUDIT_LOG_TABLE>
WHERE TO_TIMESTAMP_NTZ("event_time" / 1000000) >= '2025-05-05 21:30:00' ORDER BY "event_time" DESC;

Query 4: Filter to your own activity

SQL
SELECT
TO_TIMESTAMP_NTZ("event_time" / 1000000) AS event_ts,  "event_name",
"event_data":workflowId::string AS workflow_id,
"event_data"
FROM <YOUR_DATABASE>.<YOUR_SCHEMA>.<YOUR_AUDIT_LOG_TABLE> 
WHERE "actor_email" = 'your.email@ironcladhq.com'
ORDER BY "event_time" DESC
LIMIT 50;

Query 5: Discover all event types in your tenant

Run this once to find the exact event_name values available in your environment.

SQL
SELECT DISTINCT "event_name"
FROM <YOUR_DATABASE>.<YOUR_SCHEMA>.<YOUR_AUDIT_LOG_TABLE> ORDER BY "event_name";

Query 6: Filter to specific event types

After identifying the exact values in your tenant, filter for the ones you care about.

SQL
SELECT
TO_TIMESTAMP_NTZ("event_time" / 1000000) AS event_ts,  "event_name",
"actor_email",
"event_data":workflowId::string AS workflow_id,
"event_data"
FROM <YOUR_DATABASE>.<YOUR_SCHEMA>.<YOUR_AUDIT_LOG_TABLE> WHERE "event_name" IN (
'WORKFLOW_LAUNCHED',
'WORKFLOW_VIEWED',
'WORKFLOW_COMMENT_CREATED',
'WORKFLOW_APPROVER_ADDED',
'WORKFLOW_APPROVED',
'WORKFLOW_REJECTED',
'WORKFLOW_SIGNED',
'ADMIN_USER_UPDATED',
'ADMIN_GROUP_UPDATED'
)
ORDER BY "event_time" DESC
LIMIT 100;

Query 7: Filter by workflow ID

SQL
SELECT
TO_TIMESTAMP_NTZ("event_time" / 1000000) AS event_ts
"event_name",
"actor_email",
"event_data"
FROM <YOUR_DATABASE>.<YOUR_SCHEMA>.<YOUR_AUDIT_LOG_TABLE>
WHERE "event_data":workflowId::string = '<your-test-workflow-id>' ORDER BY "event_time" DESC;

Query 8: Inspect the raw JSON payload

Different event types carry different JSON structures. Use this query to inspect the payload.

SQL
SELECT
"event_name"
"event_data"
FROM <YOUR_DATABASE>.<YOUR_SCHEMA>.<YOUR_AUDIT_LOG_TABLE>
ORDER BY "event_time" DESC
LIMIT 10;

Use the keys you find in "event_data" such as workflowId, workflowName, commentId, or stepId in later queries.

Part 4: Confirm the test passed

Use this checklist to validate the integration end to end:

• SELECT * on the audit log table returns rows
• MAX("event_time") shows a recent timestamp
• Your admin change appears in the audit log with the expected actor_email and time
• Your workflow comment appears, likely as WORKFLOW_COMMENT_CREATED
• Your approver addition appears, likely as WORKFLOW_APPROVER_ADDED
• Your workflow action appears, for example WORKFLOW_APPROVED or WORKFLOW_SIGNED
• "event_data":workflowId::string matches the workflow ID from the Ironclad URL

If every item is confirmed, the integration is working as expected.

Troubleshooting

Potential error causes

Quoted lowercase column names

Ironclad data export creates quoted, lowercase identifiers. In Snowflake, quoted identifiers preserve case, so unquoted references such as EVENT_TIME or TIMESTAMP will not match the exported column names.

Microsecond timestamps

Many event-streaming systems store timestamps in microseconds for higher precision. In Snowflake, divide by 1000000 before converting with TO_TIMESTAMP_NTZ.

JSON-nested fields

Fields such as workflowId are often nested inside the "event_data" VARIANT column rather than exposed as top-level columns. Extract them with Snowflake's JSON path syntax.

Useful Queries

Latest sync timestamp

SQL
SELECT TO_TIMESTAMP_NTZ(MAX("event_time") / 1000000) AS last_event_synced 
FROM <YOUR_DATABASE>.<YOUR_SCHEMA>.<YOUR_AUDIT_LOG_TABLE>;

Count events by type in the last 24 hours

SQL
SELECT "event_name", COUNT(*) AS event_count
FROM <YOUR_DATABASE>.<YOUR_SCHEMA>.<YOUR_AUDIT_LOG_TABLE> 
WHERE "event_time" / 1000000 >= DATE_PART(EPOCH_SECOND, DATEADD(HOUR, -24, CURRENT_TIMESTAMP()))
GROUP BY "event_name"
ORDER BY event_count DESC;

Count events by user in the last 7 days

SQL
SELECT "actor_email", COUNT(*) AS event_count
FROM <YOUR_DATABASE>.<YOUR_SCHEMA>.<YOUR_AUDIT_LOG_TABLE> 
WHERE "event_time" / 1000000 >= DATE_PART(EPOCH_SECOND, DATEADD(DAY, -7, CURRENT_TIMESTAMP()))
GROUP BY "actor_email"
ORDER BY event_count DESC;

Pretty event timeline

SQL
SELECT
TO_TIMESTAMP_NTZ("event_time" / 1000000) AS event_ts,  "event_name",
"actor_name",
"actor_email",
"event_data":workflowId::string AS workflow_id,
"event_data":workflowName::string AS workflow_name
FROM <YOUR_DATABASE>.<YOUR_SCHEMA>.<YOUR_AUDIT_LOG_TABLE> ORDER BY "event_time" DESC
LIMIT 50;